'HSBC finally paid me £4,000 after I was fleeced by one of its criminal customers'

A high street bank used by an eBay fraudster to steal thousands of pounds has agreed to refund a scam victim the full amount as a “goodwill gesture”.

HSBC refused to explain why it would be refunding £4,000 to Halim Soltani and his wife after they realised they had been defrauded but experts suggested it might have been because the bank realised the criminal’s account should “never have existed”.

Other banks used by fraudsters have refused refunds in similar circumstances, highlighting the inconsistent approach to fraud in the banking sector.

‘I had to email HSBC’s chief executive’

Mr Soltani found a shepherds hut on eBay listed for £5,000. The seller agreed to reduce the price to £4,000 for a “quick sale” and a few days later Mr Soltani received an invoice sent in a spoofed email which looked as if it came from eBay and paid £4,000 by bank transfer.

The hut failed to show up and the seller stopped responding to messages. Mr Soltani said he realised that he had been duped when he saw the hut relisted on eBay under a different user name.

Ebay refused to refund him as he hadn’t paid through the platform using PayPal.

Mr Soltani said: “It’s ridiculous how we’re protected through PayPal and when we use credit cards but not when we pay by bank transfer. This was still a crime - why aren’t we protected?

I believe the bank made a gesture of goodwill because it recognized the receiving account should not have existedRichard Emery, 4Keys International

Mr Soltani first contacted eBay, his bank, Santander, his local police and Action Fraud, the national cybercrime reporting service. When none of these organisations was able to help he wrote to this newspaper for advice before emailing the chief executive of HSBC.

He gave us the details of the fraudster’s HSBC account – the account number, sort code and account holder’s name – and we offered to cross-check them with a source who collates data on fraudulent accounts.

Our source had no record of the account but said the surname of the account holder, Andy Rybbar, had been associated with a number of accounts set up in September this year for the purpose of fraud and that he had alerted the Financial Conduct Authority (FCA), the City regulator.

Mr Soltani included this information in the email he sent to HSBC’s boss on November 3. He referred to the notification to the FCA and asked why HSBC allowed the account to be set up and what checks and controls were used.

Less than a week later the bank agreed to reimburse the money although it refused to share any information about the fraudulent account because of its “data protection responsibilities”. The money was refunded on November 8.

HSBC refused to explain to Telegraph Money why it had offered a refund in circumstances where other banks had not.

Mr Soltani already owns a shepherds hut but was looking for another one to expand his Airbnb portfolioCredit:
Paul Grover

It said “each case is looked at individually” and in this case it had “considered all the facts and decided to refund as a goodwill gesture”.

Richard Emery of fraud consultancy 4Keys International, who has appeared as an expert witness in fraud cases, said he believed that HSBC had decided to pay up because it might have discovered that it had made a mistake with the account involved.

He said: “I believe the bank made a gesture of goodwill because it recognised that the receiving account should not have existed. This is different from admitting that there are flaws with its general anti-money laundering processes.”

Experts have advised victims to hold the “recipient bank” – the one used by the fraudster – to account.

“If the answer is yes, the banks should be viewed as having facilitated the crime,” he said.

Boost for victims: MP backs Telegraph campaign

Telegraph Money was the first to highlight the significance of the “recipient bank” in cases of bank transfer fraud. This is the bank that runs the criminal’s account, the one to which the victim is deceived into sending his or her money, as opposed to the victim’s own bank.

The bank refunded him the full amount plus interest and compensation three years after the scam took place.

However, victims are often turned away by the recipient bank when they try to report the crime or ask for information about the fraudster’s account on the grounds that the bank has no duty of care to non-customers.

“Data protection” is often cited. As a result, success stories are rare, even when there is glaring evidence that banks’ systems have failed.

But our campaign received a boost this week when MPs attacked banks for failing to tackle online fraud or to compensate victims when their processes for vetting new customers were found to be lax.

Maria Miller, MP for Basingstoke, secured a Westminster Hall debate on Tuesday on “fraudulent accounts in the banking sector”, during which she demanded to know which organisations were holding banks to account when their systems failed, and acknowledged this newspaper’s attempts to force recipient banks to take responsibility.

She also highlighted how the City regulator had the power to fine firms but would not look at “individual cases”.

The Financial Ombudsman Service can usually look at problems only with a customer’s own bank or with matters that directly concern the payment in question – not account opening processes.

Ms Miller called for a review of “banking responsibility” and an extension of consumer protection for those tricked by bank transfer fraud.

The public accounts committee, which looks at government spending, also criticised the banks’ response to online fraud, which it said had “not been proportionate to the scale of the problem”.

It said it was “not convinced” that fraud awareness campaigns, such as “Take Five”, led by Financial Fraud Action UK, the industry body, were effective.

Have you been a victim of a scam and have proof your bank didn't follow its processes? Email amelia.murray@telegraph.co.uk

* Starred links are provided by a Telegraph commercial partner. All editorial content is entirely independent of these relationships